Security

Ask something
Discussion Locked

Keeping users honest/collecting evidence

0 helpful
7 replies

by Member 25073181 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi everyone
This is probably not everyones idea of fun things to do on a network (including mine!), but the boss does want it done.
We run regular sweeps of our file servers to look for inappropriate use/non-business related use. This mostly takesthe form of image files of very "suspect" nature.

The problem that we have is
A: The utility that we currently use (PowerDesk Find File) allows you to search for specified file types, but has no built in viewer. So you are basically forced to search mostly based upon file name - not very efficient
B: Finding the file in the first place and determining its nature sometimes destroys evidence (last date/time accessed, ownership etc) that may need to be used if any action is taken against thefiles owner.

Does anyone know of any forensic utility that
- Works over a NT network. That is focusses on searching for evidence on a network drive rather that a local drive
- Has an inbuilt file viewer
- Leaves all attributes of file intact
I have come across a couple of packages so far (Encase, Forensic Toolkit), but they mostly concentrate on gather data of of PC hardrives rather than networks.

Any recommendations would be much appreciated.

Regards

Daryl Sheppard
daryl_s@iprimus.com.au

7 replies

by cavedweller

You can scan your backup tapes (you do make backups I hope!) offline. If that doesn't work you can still scan on-line files and have the proof on the tape.

by difster

You may want to take a step back and make sure that you're logging all web connections (make sure you log newsgroup use). Since very few people would bring inappropriate stuff in on their own disk, you can bet 99% of it is coming through the net. Also, make sure all the users know that connection logs are being kept; deterrance is always better than enforcement.

by Member 25073181

Thanks that would be the ideal solution but unfortunately my organisation is national with the proxy and firewall administered centrally. With so many users they only take notice of very extensive misuse, so it is very easy to slip under their radar.

by estebandelatorre

Consider NT auditing in order to search for those NEW only suspected file. Audit files will tell you who & when and from where the file was created.
Once you have the "source evidence", you can see the file by double clicking it, yes ok, you will need to have a large amount of apps instaled, like pdf, work, hex viewers, VB, password crackers, and so on.
Local disk SHOULD be audit too, this is the best place for hiding info.
The info Allways will be protected with a strange name like $temp.file , allways will be password protected with word zip or any other utility
Hope it helps!!!

by Member 25073181

Thanks, but unfortunately we have some limitation in terms of what options we can use (Domain is administered centrally, we are just a small location), we have tried but do not have that functionality available to us

This discussion is closed to new replies.